r15305: Let winbind search by sid directly (or in windows terms: "bind to a

sid"); works in all AD versions I tested. Also add "net ads sid" search
tool.

Guenther
(This used to be commit 5557ada6943b817d28a5471c613c7291febe2ad5)

2 files changed, 25 insertions, 104 deletions

diff --git a/source3/libads/ads_ldap.c b/source3/libads/ads_ldap.c
deleted file mode 100644
index 42821496c3..0000000000
--- a/source3/libads/ads_ldap.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/* 
-   Unix SMB/CIFS implementation.
-
-   Winbind ADS backend functions
-
-   Copyright (C) Andrew Tridgell 2001
-   Copyright (C) Andrew Bartlett 2002
-   
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "includes.h"
-#ifdef HAVE_LDAP
-
-/* convert a sid to a DN */
-
-ADS_STATUS ads_sid_to_dn(ADS_STRUCT *ads,
-			 TALLOC_CTX *mem_ctx,
-			 const DOM_SID *sid,
-			 char **dn)
-{
-	ADS_STATUS rc;
-	LDAPMessage *msg = NULL;
-	LDAPMessage *entry = NULL;
-	char *ldap_exp;
-	char *sidstr = NULL;
-	int count;
-	char *dn2 = NULL;
-
-	const char *attr[] = {
-		"dn",
-		NULL
-	};
-
-	if (!(sidstr = sid_binstring(sid))) {
-		DEBUG(1,("ads_sid_to_dn: sid_binstring failed!\n"));
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	if(!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr))) {
-		DEBUG(1,("ads_sid_to_dn: talloc_asprintf failed!\n"));
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	rc = ads_search_retry(ads, (void **)(void *)&msg, ldap_exp, attr);
-
-	if (!ADS_ERR_OK(rc)) {
-		DEBUG(1,("ads_sid_to_dn ads_search: %s\n", ads_errstr(rc)));
-		goto done;
-	}
-
-	if ((count = ads_count_replies(ads, msg)) != 1) {
-		fstring sid_string;
-		DEBUG(1,("ads_sid_to_dn (sid=%s): Not found (count=%d)\n", 
-			 sid_to_string(sid_string, sid), count));
-		rc = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
-		goto done;
-	}
-
-	entry = ads_first_entry(ads, msg);
-
-	dn2 = ads_get_dn(ads, entry);
-
-	if (!dn2) {
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	*dn = talloc_strdup(mem_ctx, dn2);
-
-	if (!*dn) {
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	rc = ADS_ERROR_NT(NT_STATUS_OK);
-
-	DEBUG(3,("ads sid_to_dn mapped %s\n", dn2));
-
-	SAFE_FREE(dn2);
-done:
-	if (msg) ads_msgfree(ads, msg);
-	if (dn2) ads_memfree(ads, dn2);
-
-	SAFE_FREE(sidstr);
-
-	return rc;
-}
-
-#endif
diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
index 18caa2c63a..105fd2e5b9 100644
--- a/source3/libads/ldap_utils.c
+++ b/source3/libads/ldap_utils.c
@@ -105,4 +105,29 @@ ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, void **res,
 	return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 				   "(objectclass=*)", attrs, res);
 }
+
+ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, void **res, 
+				const DOM_SID *sid,
+				const char **attrs)
+{
+	char *dn, *sid_string;
+	ADS_STATUS status;
+	
+	sid_string = sid_binstring_hex(sid);
+	if (sid_string == NULL) {
+		return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+	}
+
+	if (!asprintf(&dn, "<SID=%s>", sid_string)) {
+		SAFE_FREE(sid_string);
+		return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+	}
+
+	status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
+				   "(objectclass=*)", attrs, res);
+	SAFE_FREE(dn);
+	SAFE_FREE(sid_string);
+	return status;
+}
+
 #endif